The Security Rule requires policies and procedures for the final disposition of ePHI and for removing ePHI from electronic media before it is reused. Both are marked required. For a vendor, that covers physical drives, backups, snapshots and cloud volumes. Ask for the written procedure and for proof it was followed.
What the rule lists
Under device and media controls, the standard asks for policies governing the receipt and removal of hardware and electronic media that contain ePHI into and out of a facility, and their movement within it. The specifications are:
| Specification | Label | Plain meaning |
|---|---|---|
| Disposal | Required | Policy for final disposition of ePHI and the hardware it sits on |
| Media re-use | Required | Remove ePHI before media is reused |
| Accountability | Addressable | Record movements of hardware and media and who is responsible |
| Data backup and storage | Addressable | Make a retrievable exact copy before moving equipment |
Cloud makes this harder
You cannot shred a virtual disk. A vendor on shared infrastructure relies on provider processes and on its own deletion steps. The questions change:
- How are volumes, snapshots and object stores deleted at contract end?
- Are encryption keys destroyed, and who controls them?
- How long do backups persist, and how is expiry enforced?
- How do you handle failed drives and returned hardware at the provider?
- Is there a record, with dates, of what was deleted?
Key destruction can make data unreadable, but verify the vendor's approach and do not assume it solves every copy.
Developer laptops and test systems
Laptops, USB drives, local database dumps and build servers are the usual gaps. Ask whether staff can store ePHI locally, whether disks are encrypted, and how devices are wiped at departure.
Evidence worth requesting
- The written disposal and media re-use policy.
- A sample certificate or log entry from a recent disposal.
- The inventory or record showing movement of hardware.
- A statement of how subcontractors dispose of data.
A short example
A vendor ends a contract and says it deleted your database. The record shows the primary store was wiped, but nightly backups last ninety days and a support export sits in a shared drive. The disposal duty covers information in any form, so ask for a dated list of each location, the method used and who confirmed it. Build that list before you sign, not after you leave, and put the expiry of backups in the contract so the final date is known.
Questions for your own team
The same rule applies to you. Check how your staff retire laptops, phones and test servers, and keep a record of what was wiped, when and by whom. Vendors often meet the standard on paper while the buyer's own spare drives sit in a cupboard.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning, reachability analysis, continuous monitoring and evidence automation that can support a vendor review. You can run a free scan at gold.safeguard.sh/scan. It does not make any organisation compliant with HIPAA, and this post is not legal advice.
Quick check
Are disposal procedures addressable?
Disposal and media re-use are marked required. Accountability and backup before movement are addressable.
Does encryption replace disposal?
No. It can reduce exposure, but you still need a disposal procedure and should confirm how keys are handled.
Sources
Last reviewed: 19 October 2026.
